pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-24 14:55:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

Browse Source 
A panel or API request rejected for a missing or wrong CSRF token got a bare
403 and left nothing in the log, so an operator chasing failed logins from a
stale tab or a script had no trace. CSRFMiddleware now logs a warning with the
method, path and client address. The address comes from getRemoteIp, which
honours the trusted-proxy list, instead of gin's ClientIP, which trusts any
peer's X-Forwarded-For.
This commit is contained in:
ericanannn-blip
2026-10-24 10:51:21 +08:00
committed by GitHub
parent 864cbd234a
commit 3051aebb28
6 changed files with 53 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/index.go
+3 -3
View File
@@ -47,9 +47,9 @@ func (a *IndexController) initRouter(g *gin.RouterGroup) {
g.GET("/sponsors", a.sponsors)
g.GET("/sponsors/logo/:name", a.sponsorLogo)
g.POST("/login", middleware.CSRFMiddleware(), a.login)
g.POST("/logout", middleware.CSRFMiddleware(), a.logout)
g.POST("/getTwoFactorEnable", middleware.CSRFMiddleware(), a.getTwoFactorEnable)
g.POST("/login", middleware.CSRFMiddleware(getRemoteIp), a.login)
g.POST("/logout", middleware.CSRFMiddleware(getRemoteIp), a.logout)
g.POST("/getTwoFactorEnable", middleware.CSRFMiddleware(getRemoteIp), a.getTwoFactorEnable)
}
// sponsors is public so the login page can render its slot; failures stay silent.